@kya-os/mcp-i-cloudflare 1.13.4 → 1.13.6

package/dist/providers/kv-identity.js

@@ -8,11 +8,41 @@
  * session-based or shard-based Durable Object routing.
  */
 import { IdentityProvider } from '@kya-os/mcp';
+import { WorkersIdentityProvider, hasConfiguredIdentityEnv } from './storage';
+/**
+ * The identity provider `createCloudflareRuntime` hands to the runtime.
+ *
+ * Env is global and authoritative. When the `MCP_IDENTITY_*` triple is present
+ * the provider is the bare `WorkersIdentityProvider` and is NEVER wrapped in
+ * `KVIdentityProvider`: the Workers provider re-validates the triple on every
+ * load (`getConfiguredIdentity` fails closed on an inconsistent one), whereas
+ * the KV wrapper answers from its in-memory cache or the `identity:primary`
+ * record BEFORE it ever consults its fallback. Wrapped, a stale identity left
+ * in KV by an earlier deploy, or one generated before the identity was
+ * provisioned, would silently shadow the configured identity and skip the
+ * consistency check entirely; the worker would then sign as a DID nobody
+ * registered. That is exactly the hardware-world live path (its prefixed
+ * `*_IDENTITY_STORAGE` binding is mapped to `IDENTITY_STORAGE`).
+ *
+ * KV exists only to persist a GENERATED identity across isolates and Durable
+ * Object instances, so it is wired in exactly when there is no configured
+ * identity to persist.
+ */
+export function createCloudflareIdentityProvider(env, cryptoProvider, durableObjectState) {
+    const workersIdentityProvider = new WorkersIdentityProvider(env, cryptoProvider, durableObjectState);
+    if (hasConfiguredIdentityEnv(env) || !env.IDENTITY_STORAGE) {
+        return workersIdentityProvider;
+    }
+    return new KVIdentityProvider(env.IDENTITY_STORAGE, workersIdentityProvider, cryptoProvider);
+}
 /**
  * KV Identity Provider for Cloudflare Workers
  *
  * Uses KV namespace to store identity, ensuring all DO instances
  * share the same agent identity.
+ *
+ * Only for GENERATED identities: see `createCloudflareIdentityProvider` for
+ * why an env-configured identity must never sit behind this wrapper.
  */
 export class KVIdentityProvider extends IdentityProvider {
     kv;

package/dist/providers/kv-identity.js.map

@@ -1 +1 @@
-{"version":3,"file":"kv-identity.js","sourceRoot":"","sources":["../../src/providers/kv-identity.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,gBAAgB,EAAiB,MAAM,aAAa,CAAC;AAG9D;;;;;GAKG;AACH,MAAM,OAAO,kBAAmB,SAAQ,gBAAgB;IAC9C,EAAE,CAAc;IAChB,QAAQ,CAAmB;IAC3B,MAAM,CAAkB;IACxB,cAAc,CAAiB;IAC/B,WAAW,GAAG,kBAAkB,CAAC;IAEzC,YACE,EAAe,EACf,QAA0B,EAC1B,MAAuB;QAEvB,KAAK,EAAE,CAAC;QACR,IAAI,CAAC,EAAE,GAAG,EAAE,CAAC;QACb,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;QACzB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,WAAW;QACf,sCAAsC;QACtC,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;YACxB,OAAO,IAAI,CAAC,cAAc,CAAC;QAC7B,CAAC;QAED,eAAe;QACf,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;YACnD,IAAI,MAAM,EAAE,CAAC;gBACX,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAkB,CAAC;gBACrD,IAAI,CAAC,cAAc,GAAG,QAAQ,CAAC;gBAC/B,OAAO,QAAQ,CAAC;YAClB,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,IAAI,CAAC,8DAA8D,EAAE,KAAK,CAAC,CAAC;QACtF,CAAC;QAED,uCAAuC;QACvC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;QAEnD,6BAA6B;QAC7B,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC;YAC9D,IAAI,CAAC,cAAc,GAAG,QAAQ,CAAC;QACjC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,IAAI,CAAC,sDAAsD,EAAE,KAAK,CAAC,CAAC;YAC5E,mDAAmD;QACrD,CAAC;QAED,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,YAAY,CAAC,QAAuB;QACxC,IAAI,CAAC,cAAc,GAAG,QAAQ,CAAC;QAE/B,aAAa;QACb,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC;QAChE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,IAAI,CAAC,qDAAqD,EAAE,KAAK,CAAC,CAAC;QAC7E,CAAC;QAED,4BAA4B;QAC5B,MAAM,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;IAC7C,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,UAAU;QACd,sDAAsD;QACtD,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,UAAU,EAAE,CAAC;QAErD,+BAA+B;QAC/B,MAAM,IAAI,CAAC,YAAY,CAAC,WAAW,CAAC,CAAC;QAErC,OAAO,WAAW,CAAC;IACrB,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,cAAc;QAClB,IAAI,CAAC,cAAc,GAAG,SAAS,CAAC;QAEhC,iBAAiB;QACjB,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QACzC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,IAAI,CAAC,yDAAyD,EAAE,KAAK,CAAC,CAAC;QACjF,CAAC;QAED,kDAAkD;QAClD,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,QAAQ,CAAC,cAAc,EAAE,CAAC;QACvC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,IAAI,CAAC,+DAA+D,EAAE,KAAK,CAAC,CAAC;YACrF,wDAAwD;QAC1D,CAAC;IACH,CAAC;CACF"}
+{"version":3,"file":"kv-identity.js","sourceRoot":"","sources":["../../src/providers/kv-identity.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,gBAAgB,EAAiB,MAAM,aAAa,CAAC;AAG9D,OAAO,EAAE,uBAAuB,EAAE,wBAAwB,EAAE,MAAM,WAAW,CAAC;AAa9E;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,gCAAgC,CAC9C,GAA0B,EAC1B,cAA8B,EAC9B,kBAA6E;IAE7E,MAAM,uBAAuB,GAAG,IAAI,uBAAuB,CACzD,GAAG,EACH,cAAc,EACd,kBAAkB,CACnB,CAAC;IAEF,IAAI,wBAAwB,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;QAC3D,OAAO,uBAAuB,CAAC;IACjC,CAAC;IAED,OAAO,IAAI,kBAAkB,CAC3B,GAAG,CAAC,gBAAgB,EACpB,uBAAuB,EACvB,cAAc,CACf,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,OAAO,kBAAmB,SAAQ,gBAAgB;IAC9C,EAAE,CAAc;IAChB,QAAQ,CAAmB;IAC3B,MAAM,CAAkB;IACxB,cAAc,CAAiB;IAC/B,WAAW,GAAG,kBAAkB,CAAC;IAEzC,YACE,EAAe,EACf,QAA0B,EAC1B,MAAuB;QAEvB,KAAK,EAAE,CAAC;QACR,IAAI,CAAC,EAAE,GAAG,EAAE,CAAC;QACb,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;QACzB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,WAAW;QACf,sCAAsC;QACtC,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;YACxB,OAAO,IAAI,CAAC,cAAc,CAAC;QAC7B,CAAC;QAED,eAAe;QACf,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;YACnD,IAAI,MAAM,EAAE,CAAC;gBACX,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAkB,CAAC;gBACrD,IAAI,CAAC,cAAc,GAAG,QAAQ,CAAC;gBAC/B,OAAO,QAAQ,CAAC;YAClB,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,IAAI,CAAC,8DAA8D,EAAE,KAAK,CAAC,CAAC;QACtF,CAAC;QAED,uCAAuC;QACvC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;QAEnD,6BAA6B;QAC7B,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC;YAC9D,IAAI,CAAC,cAAc,GAAG,QAAQ,CAAC;QACjC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,IAAI,CAAC,sDAAsD,EAAE,KAAK,CAAC,CAAC;YAC5E,mDAAmD;QACrD,CAAC;QAED,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,YAAY,CAAC,QAAuB;QACxC,IAAI,CAAC,cAAc,GAAG,QAAQ,CAAC;QAE/B,aAAa;QACb,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC;QAChE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,IAAI,CAAC,qDAAqD,EAAE,KAAK,CAAC,CAAC;QAC7E,CAAC;QAED,4BAA4B;QAC5B,MAAM,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;IAC7C,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,UAAU;QACd,sDAAsD;QACtD,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,UAAU,EAAE,CAAC;QAErD,+BAA+B;QAC/B,MAAM,IAAI,CAAC,YAAY,CAAC,WAAW,CAAC,CAAC;QAErC,OAAO,WAAW,CAAC;IACrB,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,cAAc;QAClB,IAAI,CAAC,cAAc,GAAG,SAAS,CAAC;QAEhC,iBAAiB;QACjB,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QACzC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,IAAI,CAAC,yDAAyD,EAAE,KAAK,CAAC,CAAC;QACjF,CAAC;QAED,kDAAkD;QAClD,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,QAAQ,CAAC,cAAc,EAAE,CAAC;QACvC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,IAAI,CAAC,+DAA+D,EAAE,KAAK,CAAC,CAAC;YACrF,wDAAwD;QAC1D,CAAC;IACH,CAAC;CACF"}

package/dist/providers/storage.d.ts

@@ -4,7 +4,8 @@
  * Implements StorageProvider and NonceCacheProvider using Cloudflare KV.
  */
 import { StorageProvider, NonceCacheProvider, ClockProvider, FetchProvider, IdentityProvider, AgentIdentity } from "@kya-os/mcp";
-export { WebCryptoProvider } from "./crypto.js";
+import { WebCryptoProvider } from "./crypto.js";
+export { WebCryptoProvider };
 /**
  * Minimal KV interface for compatibility across @cloudflare/workers-types versions
  * Only includes the methods we actually use
@@ -76,18 +77,85 @@ interface ConfiguredIdentityEnv {
     MCP_IDENTITY_PUBLIC_KEY?: string;
     MCP_IDENTITY_AGENT_DID?: string;
 }
+/**
+ * Which part of a configured `MCP_IDENTITY_*` triple failed the consistency
+ * check. Surfaced on {@link ConfiguredIdentityError} so callers and logs can
+ * name the exact pair an operator has to fix.
+ */
+export type ConfiguredIdentityMismatch = "PRIVATE_KEY" | "PUBLIC_KEY" | "PRIVATE_KEY/PUBLIC_KEY" | "AGENT_DID/PUBLIC_KEY";
+/**
+ * Thrown by {@link getConfiguredIdentity} when all three `MCP_IDENTITY_*` vars
+ * are present but do not describe ONE Ed25519 key pair. Distinct from the
+ * `null` "not configured" result on purpose: see the fail-closed note on
+ * `getConfiguredIdentity`.
+ */
+export declare class ConfiguredIdentityError extends Error {
+    readonly mismatch: ConfiguredIdentityMismatch;
+    constructor(mismatch: ConfiguredIdentityMismatch, detail: string);
+}
+/**
+ * The verification-method id (`kid`) for a DID, by DID method.
+ *
+ * - `did:key` → `<did>#<multibase>`: the did:key spec fixes the fragment to the
+ *   multibase public-key value. That is what `@kya-os/mcp`'s
+ *   `createDidKeyResolver`, the contracts fixtures and this package's
+ *   `WorkersFetchProvider.resolveDID` publish, so a proof carrying this kid
+ *   resolves to a verification method on every path that verifies this
+ *   package's proofs. Not yet universal: `@kya-os/mcp-i-runtime`'s
+ *   `createDIDDocument` and `@kya-os/mcp-i`'s `NodeFetchProvider.resolveDID`
+ *   still emit `#key-1` for every DID method (known follow-up, not changed
+ *   here).
+ * - everything else (`did:web` in practice) → `<did>#key-1`, which is the id
+ *   the runtime's own `createDIDDocument` serves at `/.well-known/did.json`.
+ */
+export declare function kidForDid(did: string): string;
+/**
+ * Whether `env` carries a complete `MCP_IDENTITY_*` triple. Presence only,
+ * no validation: use it to decide WHICH identity path a deployment is on
+ * (env-configured vs generated/persisted), then let `getConfiguredIdentity`
+ * decide whether that triple is actually usable.
+ */
+export declare function hasConfiguredIdentityEnv(env: ConfiguredIdentityEnv): env is ConfiguredIdentityEnv & {
+    MCP_IDENTITY_PRIVATE_KEY: string;
+    MCP_IDENTITY_PUBLIC_KEY: string;
+    MCP_IDENTITY_AGENT_DID: string;
+};
 /**
  * The deployment's own provisioned identity, read directly from env vars — or
  * `null` when any of the three are absent (an older/undeployed-identity worker).
  *
- * Pure and side-effect-free: callers that want the DO-state-caching/fallback-
- * generation behavior on top of this should use `WorkersIdentityProvider`, which
- * is built on this same check. Extracted so a caller that only needs "is there a
- * real configured identity, and if so what is it" — with its OWN fallback
- * strategy when there isn't one — doesn't have to instantiate a class designed
- * for a different concern (DO-state persistence across cold starts).
+ * When all three are present they are CHECKED, not trusted: the three values
+ * are provisioned as independent secrets/vars and nothing else ever confirms
+ * they belong together. The public key is re-derived from
+ * `MCP_IDENTITY_PRIVATE_KEY` and must equal `MCP_IDENTITY_PUBLIC_KEY`; for a
+ * did:key, the DID is re-derived from that public key and must equal
+ * `MCP_IDENTITY_AGENT_DID`. (A did:web DID cannot be checked offline - its key
+ * lives in a remotely hosted did.json - so only the key pair is verified.)
+ *
+ * FAIL-CLOSED DECISION: an inconsistent triple THROWS `ConfiguredIdentityError`
+ * rather than returning `null`. `null` means "this deployment has no configured
+ * identity", and every caller reads it that way - `WorkersIdentityProvider`
+ * falls through to DO state or generates a fresh did:key, and the consent
+ * anchor bridge mints with an ephemeral issuer. A misprovisioned identity must
+ * not silently take either path: the worker would then sign as some DID other
+ * than the one operators registered and advertised, which is the exact drift
+ * that made the hardware-world worker's response proofs unverifiable. Throwing
+ * surfaces the misconfiguration at the first signing attempt, with the
+ * offending pair named, instead of hiding it behind a working-looking worker.
+ *
+ * Side-effect-free (no logging, no storage) apart from a per-env memo of the
+ * result (see `configuredIdentityMemo`): callers that want the DO-state-
+ * caching/fallback-generation behavior on top of this should use
+ * `WorkersIdentityProvider`, which is built on this same check. Extracted so a
+ * caller that only needs "is there a real configured identity, and if so what
+ * is it", with its OWN fallback strategy when there isn't one, doesn't have
+ * to instantiate a class designed for a different concern (DO-state
+ * persistence across cold starts).
+ *
+ * Async because the Web Crypto API (the only Ed25519 implementation available
+ * in Workers) is async.
  */
-export declare function getConfiguredIdentity(env: ConfiguredIdentityEnv): AgentIdentity | null;
+export declare function getConfiguredIdentity(env: ConfiguredIdentityEnv): Promise<AgentIdentity | null>;
 /**
  * Workers Identity Provider with Durable Object state persistence
  *
@@ -100,28 +168,18 @@ export declare class WorkersIdentityProvider extends IdentityProvider {
     private env;
     private cryptoProvider?;
     private state?;
+    /**
+     * The env-configured identity this instance last wrote to DO state.
+     * `getConfiguredIdentity` memoizes per env object, so while the triple is
+     * unchanged it resolves to the SAME object: compare by reference to persist
+     * once per (instance, triple) instead of on every `getIdentity()` call (the
+     * McpAgent path calls it several times per tool call).
+     */
+    private persistedConfiguredIdentity?;
     constructor(env: any, cryptoProvider?: any | undefined, state?: DurableObjectState | undefined);
     getIdentity(): Promise<AgentIdentity>;
     saveIdentity(identity: AgentIdentity): Promise<void>;
     rotateKeys(): Promise<AgentIdentity>;
     deleteIdentity(): Promise<void>;
-    /**
-     * Generate did:key from Ed25519 public key
-     * Following spec: https://w3c-ccg.github.io/did-method-key/
-     *
-     * Format: did:key:z<multibase-base58btc(<multicodec-ed25519-pub><publicKey>)>
-     * Ed25519 multicodec prefix: 0xed 0x01
-     * Result starts with: did:key:z6Mk (for Ed25519 keys)
-     */
-    private generateDIDFromPublicKey;
-    /**
-     * Base58 encode (Bitcoin alphabet) using base-x library
-     */
-    private base58Encode;
-    /**
-     * Convert base64 or base64url to bytes
-     * Handles both standard base64 (+/) and base64url (-_) formats
-     */
-    private base64ToBytes;
 }
 //# sourceMappingURL=storage.d.ts.map

package/dist/providers/storage.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"storage.d.ts","sourceRoot":"","sources":["../../src/providers/storage.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EACL,eAAe,EACf,kBAAkB,EAClB,aAAa,EACb,aAAa,EACb,gBAAgB,EAChB,aAAa,EACd,MAAM,aAAa,CAAC;AAGrB,OAAO,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAQhD;;;GAGG;AACH,UAAU,eAAe;IACvB,GAAG,CACD,GAAG,EAAE,MAAM,EACX,OAAO,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,aAAa,GAAG,QAAQ,CAAA;KAAE,GAC9D,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAC1B,GAAG,CACD,GAAG,EAAE,MAAM,EACX,KAAK,EAAE,MAAM,EACb,OAAO,CAAC,EAAE;QAAE,aAAa,CAAC,EAAE,MAAM,CAAA;KAAE,GACnC,OAAO,CAAC,IAAI,CAAC,CAAC;IACjB,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACnC,IAAI,CAAC,OAAO,CAAC,EAAE;QACb,MAAM,CAAC,EAAE,MAAM,CAAC;KACjB,GAAG,OAAO,CAAC;QAAE,IAAI,EAAE,KAAK,CAAC;YAAE,IAAI,EAAE,MAAM,CAAA;SAAE,CAAC,CAAA;KAAE,CAAC,CAAC;CAChD;AAED;;GAEG;AACH,qBAAa,iBAAkB,SAAQ,eAAe;IACxC,OAAO,CAAC,EAAE;gBAAF,EAAE,EAAE,eAAe;IAIjC,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAIxC,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAI9C,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAIlC,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAKrC,IAAI,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;CAI/C;AAED;;GAEG;AACH,qBAAa,oBAAqB,SAAQ,kBAAkB;IAC9C,OAAO,CAAC,EAAE;gBAAF,EAAE,EAAE,eAAe;IAIjC,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAMvD,GAAG,CACP,KAAK,EAAE,MAAM,EACb,UAAU,EAAE,MAAM,EAClB,QAAQ,CAAC,EAAE,MAAM,GAChB,OAAO,CAAC,IAAI,CAAC;IAQV,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;IAIxB,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;CAG/B;AAED;;GAEG;AACH,qBAAa,oBAAqB,SAAQ,aAAa;IACrD,GAAG,IAAI,MAAM;IAIb,YAAY,CAAC,SAAS,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO;IAO7D,UAAU,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO;IAItC,eAAe,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM;IAI3C,MAAM,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM;CAGlC;AAED;;GAEG;AACH,qBAAa,oBAAqB,SAAQ,aAAa;IAC/C,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC;IAmCrC,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC;IAU1C,oBAAoB,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;IAKhD,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,QAAQ,CAAC;CAGnE;AAED;;;GAGG;AACH,UAAU,qBAAqB;IAC7B,wBAAwB,CAAC,EAAE,MAAM,CAAC;IAClC,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC,sBAAsB,CAAC,EAAE,MAAM,CAAC;CACjC;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,qBAAqB,CACnC,GAAG,EAAE,qBAAqB,GACzB,aAAa,GAAG,IAAI,CAiBtB;AAED;;;;;;;GAOG;AACH,qBAAa,uBAAwB,SAAQ,gBAAgB;IAEzD,OAAO,CAAC,GAAG;IACX,OAAO,CAAC,cAAc,CAAC;IACvB,OAAO,CAAC,KAAK,CAAC;gBAFN,GAAG,EAAE,GAAG,EACR,cAAc,CAAC,EAAE,GAAG,YAAA,EACpB,KAAK,CAAC,EAAE,kBAAkB,YAAA;IAK9B,WAAW,IAAI,OAAO,CAAC,aAAa,CAAC;IAkErC,YAAY,CAAC,QAAQ,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC;IAepD,UAAU,IAAI,OAAO,CAAC,aAAa,CAAC;IAkBpC,cAAc,IAAI,OAAO,CAAC,IAAI,CAAC;IAIrC;;;;;;;OAOG;IACH,OAAO,CAAC,wBAAwB;IAmBhC;;OAEG;IACH,OAAO,CAAC,YAAY;IAIpB;;;OAGG;IACH,OAAO,CAAC,aAAa;CAgBtB"}
+{"version":3,"file":"storage.d.ts","sourceRoot":"","sources":["../../src/providers/storage.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EACL,eAAe,EACf,kBAAkB,EAClB,aAAa,EACb,aAAa,EACb,gBAAgB,EAChB,aAAa,EAMd,MAAM,aAAa,CAAC;AAErB,OAAO,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAGhD,OAAO,EAAE,iBAAiB,EAAE,CAAC;AAS7B;;;GAGG;AACH,UAAU,eAAe;IACvB,GAAG,CACD,GAAG,EAAE,MAAM,EACX,OAAO,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,aAAa,GAAG,QAAQ,CAAA;KAAE,GAC9D,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAC1B,GAAG,CACD,GAAG,EAAE,MAAM,EACX,KAAK,EAAE,MAAM,EACb,OAAO,CAAC,EAAE;QAAE,aAAa,CAAC,EAAE,MAAM,CAAA;KAAE,GACnC,OAAO,CAAC,IAAI,CAAC,CAAC;IACjB,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACnC,IAAI,CAAC,OAAO,CAAC,EAAE;QACb,MAAM,CAAC,EAAE,MAAM,CAAC;KACjB,GAAG,OAAO,CAAC;QAAE,IAAI,EAAE,KAAK,CAAC;YAAE,IAAI,EAAE,MAAM,CAAA;SAAE,CAAC,CAAA;KAAE,CAAC,CAAC;CAChD;AAED;;GAEG;AACH,qBAAa,iBAAkB,SAAQ,eAAe;IACxC,OAAO,CAAC,EAAE;gBAAF,EAAE,EAAE,eAAe;IAIjC,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAIxC,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAI9C,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAIlC,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAKrC,IAAI,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;CAI/C;AAED;;GAEG;AACH,qBAAa,oBAAqB,SAAQ,kBAAkB;IAC9C,OAAO,CAAC,EAAE;gBAAF,EAAE,EAAE,eAAe;IAIjC,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAMvD,GAAG,CACP,KAAK,EAAE,MAAM,EACb,UAAU,EAAE,MAAM,EAClB,QAAQ,CAAC,EAAE,MAAM,GAChB,OAAO,CAAC,IAAI,CAAC;IAQV,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;IAIxB,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;CAG/B;AAED;;GAEG;AACH,qBAAa,oBAAqB,SAAQ,aAAa;IACrD,GAAG,IAAI,MAAM;IAIb,YAAY,CAAC,SAAS,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO;IAO7D,UAAU,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO;IAItC,eAAe,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM;IAI3C,MAAM,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM;CAGlC;AAED;;GAEG;AACH,qBAAa,oBAAqB,SAAQ,aAAa;IAC/C,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC;IAsCrC,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC;IAU1C,oBAAoB,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;IAKhD,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,QAAQ,CAAC;CAGnE;AAED;;;GAGG;AACH,UAAU,qBAAqB;IAC7B,wBAAwB,CAAC,EAAE,MAAM,CAAC;IAClC,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC,sBAAsB,CAAC,EAAE,MAAM,CAAC;CACjC;AAED;;;;GAIG;AACH,MAAM,MAAM,0BAA0B,GAClC,aAAa,GACb,YAAY,GACZ,wBAAwB,GACxB,sBAAsB,CAAC;AAE3B;;;;;GAKG;AACH,qBAAa,uBAAwB,SAAQ,KAAK;IAChD,QAAQ,CAAC,QAAQ,EAAE,0BAA0B,CAAC;gBAElC,QAAQ,EAAE,0BAA0B,EAAE,MAAM,EAAE,MAAM;CAUjE;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAI7C;AAWD;;;;;GAKG;AACH,wBAAgB,wBAAwB,CACtC,GAAG,EAAE,qBAAqB,GACzB,GAAG,IAAI,qBAAqB,GAAG;IAChC,wBAAwB,EAAE,MAAM,CAAC;IACjC,uBAAuB,EAAE,MAAM,CAAC;IAChC,sBAAsB,EAAE,MAAM,CAAC;CAChC,CAMA;AAgBD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,wBAAsB,qBAAqB,CACzC,GAAG,EAAE,qBAAqB,GACzB,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,CAsB/B;AA4ED;;;;;;;GAOG;AACH,qBAAa,uBAAwB,SAAQ,gBAAgB;IAWzD,OAAO,CAAC,GAAG;IACX,OAAO,CAAC,cAAc,CAAC;IACvB,OAAO,CAAC,KAAK,CAAC;IAZhB;;;;;;OAMG;IACH,OAAO,CAAC,2BAA2B,CAAC,CAAgB;gBAG1C,GAAG,EAAE,GAAG,EACR,cAAc,CAAC,EAAE,GAAG,YAAA,EACpB,KAAK,CAAC,EAAE,kBAAkB,YAAA;IAK9B,WAAW,IAAI,OAAO,CAAC,aAAa,CAAC;IAyFrC,YAAY,CAAC,QAAQ,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC;IAepD,UAAU,IAAI,OAAO,CAAC,aAAa,CAAC;IAkBpC,cAAc,IAAI,OAAO,CAAC,IAAI,CAAC;CAGtC"}

package/dist/providers/storage.js

@@ -3,12 +3,16 @@
  *
  * Implements StorageProvider and NonceCacheProvider using Cloudflare KV.
  */
-import { StorageProvider, NonceCacheProvider, ClockProvider, FetchProvider, IdentityProvider, } from "@kya-os/mcp";
+import { StorageProvider, NonceCacheProvider, ClockProvider, FetchProvider, IdentityProvider, getDidMethod, didKeyFragment, generateDidKeyFromBytes, base64ToBytes, createDidKeyResolver, } from "@kya-os/mcp";
+import { WebCryptoProvider } from "./crypto.js";
 // Re-export WebCryptoProvider for convenience
-export { WebCryptoProvider } from "./crypto.js";
-import baseX from "base-x";
-// Bitcoin base58 alphabet
-const base58 = baseX("123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz");
+export { WebCryptoProvider };
+/**
+ * The ONE did:key document builder this package uses. `@kya-os/mcp` owns the
+ * did:key encoding (multicodec prefix, base58btc, spec `#<multibase>` fragment,
+ * JWK + multibase keys); nothing here re-implements it.
+ */
+const didKeyResolver = createDidKeyResolver();
 /**
  * KV storage provider for Cloudflare Workers
  */
@@ -93,21 +97,22 @@ export class WorkersClockProvider extends ClockProvider {
 export class WorkersFetchProvider extends FetchProvider {
     async resolveDID(did) {
         if (did.startsWith("did:key:")) {
-            // Offline resolution for did:key
-            const publicKeyMultibase = did.slice("did:key:".length);
+            // Offline resolution for did:key, delegated to the package resolver so
+            // there is exactly one did:key document shape in this codebase. Its
+            // verification-method id is `<did>#<multibase>` (the did:key spec fixes
+            // the fragment to the key itself), which is also what `kidForDid` stamps
+            // on every did:key proof this package signs: a verifier looks the
+            // proof's kid up in THIS document, so the two have to agree. It publishes
+            // both `publicKeyJwk` (the runtime's ProofVerifier reads only that) and
+            // `publicKeyMultibase`.
+            const doc = await didKeyResolver.resolve(did);
+            if (!doc) {
+                throw new Error(`Failed to resolve ${did}: not an Ed25519 did:key ` +
+                    "(expected base58btc multibase of 0xed01 || 32-byte public key)");
+            }
             return {
                 "@context": ["https://www.w3.org/ns/did/v1"],
-                id: did,
-                verificationMethod: [
-                    {
-                        id: `${did}#key-1`,
-                        type: "Ed25519VerificationKey2020",
-                        controller: did,
-                        publicKeyMultibase,
-                    },
-                ],
-                authentication: [`${did}#key-1`],
-                assertionMethod: [`${did}#key-1`],
+                ...doc,
             };
         }
         if (did.startsWith("did:web:")) {
@@ -136,28 +141,174 @@ export class WorkersFetchProvider extends FetchProvider {
         return await fetch(url, options);
     }
 }
+/**
+ * Thrown by {@link getConfiguredIdentity} when all three `MCP_IDENTITY_*` vars
+ * are present but do not describe ONE Ed25519 key pair. Distinct from the
+ * `null` "not configured" result on purpose: see the fail-closed note on
+ * `getConfiguredIdentity`.
+ */
+export class ConfiguredIdentityError extends Error {
+    mismatch;
+    constructor(mismatch, detail) {
+        super(`Configured MCP identity is inconsistent (${mismatch}): ${detail} ` +
+            "Refusing to load it - a proof signed with this identity would not verify " +
+            "against the key its DID advertises. Re-provision MCP_IDENTITY_AGENT_DID, " +
+            "MCP_IDENTITY_PRIVATE_KEY and MCP_IDENTITY_PUBLIC_KEY from one key pair.");
+        this.name = "ConfiguredIdentityError";
+        this.mismatch = mismatch;
+    }
+}
+/**
+ * The verification-method id (`kid`) for a DID, by DID method.
+ *
+ * - `did:key` → `<did>#<multibase>`: the did:key spec fixes the fragment to the
+ *   multibase public-key value. That is what `@kya-os/mcp`'s
+ *   `createDidKeyResolver`, the contracts fixtures and this package's
+ *   `WorkersFetchProvider.resolveDID` publish, so a proof carrying this kid
+ *   resolves to a verification method on every path that verifies this
+ *   package's proofs. Not yet universal: `@kya-os/mcp-i-runtime`'s
+ *   `createDIDDocument` and `@kya-os/mcp-i`'s `NodeFetchProvider.resolveDID`
+ *   still emit `#key-1` for every DID method (known follow-up, not changed
+ *   here).
+ * - everything else (`did:web` in practice) → `<did>#key-1`, which is the id
+ *   the runtime's own `createDIDDocument` serves at `/.well-known/did.json`.
+ */
+export function kidForDid(did) {
+    return getDidMethod(did) === "key"
+        ? `${did}#${didKeyFragment(did)}`
+        : `${did}#key-1`;
+}
+function bytesEqual(left, right) {
+    if (left.length !== right.length)
+        return false;
+    let diff = 0;
+    for (let i = 0; i < left.length; i++)
+        diff |= left[i] ^ right[i];
+    return diff === 0;
+}
+const ED25519_PUBLIC_KEY_BYTES = 32;
+/**
+ * Whether `env` carries a complete `MCP_IDENTITY_*` triple. Presence only,
+ * no validation: use it to decide WHICH identity path a deployment is on
+ * (env-configured vs generated/persisted), then let `getConfiguredIdentity`
+ * decide whether that triple is actually usable.
+ */
+export function hasConfiguredIdentityEnv(env) {
+    return Boolean(env.MCP_IDENTITY_PRIVATE_KEY &&
+        env.MCP_IDENTITY_PUBLIC_KEY &&
+        env.MCP_IDENTITY_AGENT_DID);
+}
+/**
+ * Per-env memo for `getConfiguredIdentity`. Keyed on the env OBJECT (Workers
+ * hand every request the same `env` for the life of the isolate) and
+ * invalidated when any of the three strings changes, so a corrected triple is
+ * re-checked while an unchanged one is not re-derived on every proof. A
+ * rejected promise is cached too, under the triple that produced it: that is
+ * correct, because the same three strings can never start validating, and a
+ * different triple (the operator's fix) lands in a fresh entry.
+ */
+const configuredIdentityMemo = new WeakMap();
 /**
  * The deployment's own provisioned identity, read directly from env vars — or
  * `null` when any of the three are absent (an older/undeployed-identity worker).
  *
- * Pure and side-effect-free: callers that want the DO-state-caching/fallback-
- * generation behavior on top of this should use `WorkersIdentityProvider`, which
- * is built on this same check. Extracted so a caller that only needs "is there a
- * real configured identity, and if so what is it" — with its OWN fallback
- * strategy when there isn't one — doesn't have to instantiate a class designed
- * for a different concern (DO-state persistence across cold starts).
+ * When all three are present they are CHECKED, not trusted: the three values
+ * are provisioned as independent secrets/vars and nothing else ever confirms
+ * they belong together. The public key is re-derived from
+ * `MCP_IDENTITY_PRIVATE_KEY` and must equal `MCP_IDENTITY_PUBLIC_KEY`; for a
+ * did:key, the DID is re-derived from that public key and must equal
+ * `MCP_IDENTITY_AGENT_DID`. (A did:web DID cannot be checked offline - its key
+ * lives in a remotely hosted did.json - so only the key pair is verified.)
+ *
+ * FAIL-CLOSED DECISION: an inconsistent triple THROWS `ConfiguredIdentityError`
+ * rather than returning `null`. `null` means "this deployment has no configured
+ * identity", and every caller reads it that way - `WorkersIdentityProvider`
+ * falls through to DO state or generates a fresh did:key, and the consent
+ * anchor bridge mints with an ephemeral issuer. A misprovisioned identity must
+ * not silently take either path: the worker would then sign as some DID other
+ * than the one operators registered and advertised, which is the exact drift
+ * that made the hardware-world worker's response proofs unverifiable. Throwing
+ * surfaces the misconfiguration at the first signing attempt, with the
+ * offending pair named, instead of hiding it behind a working-looking worker.
+ *
+ * Side-effect-free (no logging, no storage) apart from a per-env memo of the
+ * result (see `configuredIdentityMemo`): callers that want the DO-state-
+ * caching/fallback-generation behavior on top of this should use
+ * `WorkersIdentityProvider`, which is built on this same check. Extracted so a
+ * caller that only needs "is there a real configured identity, and if so what
+ * is it", with its OWN fallback strategy when there isn't one, doesn't have
+ * to instantiate a class designed for a different concern (DO-state
+ * persistence across cold starts).
+ *
+ * Async because the Web Crypto API (the only Ed25519 implementation available
+ * in Workers) is async.
  */
-export function getConfiguredIdentity(env) {
-    if (!env.MCP_IDENTITY_PRIVATE_KEY ||
-        !env.MCP_IDENTITY_PUBLIC_KEY ||
-        !env.MCP_IDENTITY_AGENT_DID) {
+export async function getConfiguredIdentity(env) {
+    if (!hasConfiguredIdentityEnv(env)) {
         return null;
     }
-    return {
-        did: env.MCP_IDENTITY_AGENT_DID,
-        kid: `${env.MCP_IDENTITY_AGENT_DID}#key-1`,
+    const triple = JSON.stringify([
+        env.MCP_IDENTITY_PRIVATE_KEY,
+        env.MCP_IDENTITY_PUBLIC_KEY,
+        env.MCP_IDENTITY_AGENT_DID,
+    ]);
+    const memoized = configuredIdentityMemo.get(env);
+    if (memoized && memoized.triple === triple) {
+        return memoized.result;
+    }
+    const result = verifyConfiguredIdentity({
         privateKey: env.MCP_IDENTITY_PRIVATE_KEY,
         publicKey: env.MCP_IDENTITY_PUBLIC_KEY,
+        did: env.MCP_IDENTITY_AGENT_DID,
+    });
+    configuredIdentityMemo.set(env, { triple, result });
+    return result;
+}
+/** The uncached check behind `getConfiguredIdentity`; see its doc comment. */
+async function verifyConfiguredIdentity(configured) {
+    const { did } = configured;
+    // Decode the configured public key first: it is the reference both later
+    // comparisons are made against, so a value that is not even a raw key has
+    // to be named as such rather than surfacing as a confusing pair mismatch.
+    let configuredPublicKeyBytes;
+    try {
+        configuredPublicKeyBytes = base64ToBytes(configured.publicKey);
+    }
+    catch (cause) {
+        throw new ConfiguredIdentityError("PUBLIC_KEY", "MCP_IDENTITY_PUBLIC_KEY is not valid base64/base64url: " +
+            `${cause instanceof Error ? cause.message : String(cause)}.`);
+    }
+    if (configuredPublicKeyBytes.length !== ED25519_PUBLIC_KEY_BYTES) {
+        throw new ConfiguredIdentityError("PUBLIC_KEY", "MCP_IDENTITY_PUBLIC_KEY must be the raw 32-byte Ed25519 public key " +
+            `(got ${configuredPublicKeyBytes.length} bytes; SPKI/PEM is not accepted).`);
+    }
+    let derivedPublicKey;
+    try {
+        derivedPublicKey = await new WebCryptoProvider().derivePublicKey(configured.privateKey);
+    }
+    catch (cause) {
+        throw new ConfiguredIdentityError("PRIVATE_KEY", "MCP_IDENTITY_PRIVATE_KEY is not a usable Ed25519 private key " +
+            "(expected base64 of a 32-byte seed, a 64-byte seed||public-key pair, " +
+            `or PKCS#8): ${cause instanceof Error ? cause.message : String(cause)}.`);
+    }
+    // Compare key BYTES: the env value may be base64 or base64url (KTA emits
+    // base64url), and both must be accepted as the same key.
+    if (!bytesEqual(base64ToBytes(derivedPublicKey), configuredPublicKeyBytes)) {
+        throw new ConfiguredIdentityError("PRIVATE_KEY/PUBLIC_KEY", "the public key derived from MCP_IDENTITY_PRIVATE_KEY is not " +
+            "MCP_IDENTITY_PUBLIC_KEY (the two secrets come from different key pairs).");
+    }
+    if (getDidMethod(did) === "key") {
+        const didForPublicKey = generateDidKeyFromBytes(configuredPublicKeyBytes);
+        if (didForPublicKey !== did) {
+            throw new ConfiguredIdentityError("AGENT_DID/PUBLIC_KEY", `MCP_IDENTITY_AGENT_DID is ${did} but MCP_IDENTITY_PUBLIC_KEY ` +
+                `encodes to ${didForPublicKey}.`);
+        }
+    }
+    return {
+        did,
+        kid: kidForDid(did),
+        privateKey: configured.privateKey,
+        publicKey: configured.publicKey,
         createdAt: new Date().toISOString(),
         type: "production",
     };
@@ -174,6 +325,14 @@ export class WorkersIdentityProvider extends IdentityProvider {
     env;
     cryptoProvider;
     state;
+    /**
+     * The env-configured identity this instance last wrote to DO state.
+     * `getConfiguredIdentity` memoizes per env object, so while the triple is
+     * unchanged it resolves to the SAME object: compare by reference to persist
+     * once per (instance, triple) instead of on every `getIdentity()` call (the
+     * McpAgent path calls it several times per tool call).
+     */
+    persistedConfiguredIdentity;
     constructor(env, cryptoProvider, state) {
         super();
         this.env = env;
@@ -183,11 +342,33 @@ export class WorkersIdentityProvider extends IdentityProvider {
     async getIdentity() {
         // 1. ALWAYS check environment variables FIRST (highest priority)
         // This allows operators to update identity by changing env vars without clearing DO storage
-        const configured = getConfiguredIdentity(this.env);
+        let configured;
+        try {
+            configured = await getConfiguredIdentity(this.env);
+        }
+        catch (error) {
+            // Fail closed and LOUD: a present-but-inconsistent MCP_IDENTITY_* triple
+            // must not fall through to DO state or a freshly generated did:key (that
+            // would make the worker sign as an identity nobody registered). Log the
+            // specific mismatch for the operator, then let the failure propagate.
+            console.error("[Identity] Refusing to load configured identity from env vars:", error instanceof Error ? error.message : String(error));
+            throw error;
+        }
         if (configured) {
-            // Update DO state to match current env vars (overwrite any stale cached identity)
-            if (this.state) {
-                await this.state.storage.put("agent-identity", configured);
+            // Update DO state to match current env vars (overwrite any stale cached
+            // identity) - once per (instance, triple), see `persistedConfiguredIdentity`.
+            if (this.state && this.persistedConfiguredIdentity !== configured) {
+                // Mark before awaiting so a burst of concurrent first calls on a
+                // fresh instance issues one put, not one per caller; roll back on
+                // failure so the next call retries (and the failure still propagates).
+                this.persistedConfiguredIdentity = configured;
+                try {
+                    await this.state.storage.put("agent-identity", configured);
+                }
+                catch (error) {
+                    this.persistedConfiguredIdentity = undefined;
+                    throw error;
+                }
                 console.error("[Identity] Loaded from env vars, updated DO state:", configured.did.slice(0, 30) + "...");
             }
             return configured;
@@ -205,10 +386,10 @@ export class WorkersIdentityProvider extends IdentityProvider {
             throw new Error("No identity found and crypto provider not available for generation");
         }
         const keyPair = await this.cryptoProvider.generateKeyPair();
-        const did = this.generateDIDFromPublicKey(keyPair.publicKey);
+        const did = generateDidKeyFromBytes(base64ToBytes(keyPair.publicKey));
         const identity = {
             did,
-            kid: `${did}#key-1`,
+            kid: kidForDid(did),
             privateKey: keyPair.privateKey,
             publicKey: keyPair.publicKey,
             createdAt: new Date().toISOString(),
@@ -239,10 +420,10 @@ export class WorkersIdentityProvider extends IdentityProvider {
             throw new Error("Crypto provider required for key rotation");
         }
         const keyPair = await this.cryptoProvider.generateKeyPair();
-        const did = this.generateDIDFromPublicKey(keyPair.publicKey);
+        const did = generateDidKeyFromBytes(base64ToBytes(keyPair.publicKey));
         return {
             did,
-            kid: `${did}#key-1`,
+            kid: kidForDid(did),
             privateKey: keyPair.privateKey,
             publicKey: keyPair.publicKey,
             createdAt: new Date().toISOString(),
@@ -252,49 +433,5 @@ export class WorkersIdentityProvider extends IdentityProvider {
     async deleteIdentity() {
         console.warn("Identity deletion not supported in Workers runtime");
     }
-    /**
-     * Generate did:key from Ed25519 public key
-     * Following spec: https://w3c-ccg.github.io/did-method-key/
-     *
-     * Format: did:key:z<multibase-base58btc(<multicodec-ed25519-pub><publicKey>)>
-     * Ed25519 multicodec prefix: 0xed 0x01
-     * Result starts with: did:key:z6Mk (for Ed25519 keys)
-     */
-    generateDIDFromPublicKey(publicKey) {
-        const publicKeyBytes = this.base64ToBytes(publicKey);
-        // Ed25519 multicodec prefix (0xed01)
-        const multicodecPrefix = new Uint8Array([0xed, 0x01]);
-        // Combine prefix + public key
-        const multicodecKey = new Uint8Array(multicodecPrefix.length + publicKeyBytes.length);
-        multicodecKey.set(multicodecPrefix);
-        multicodecKey.set(publicKeyBytes, multicodecPrefix.length);
-        // Encode with base58-btc (starts with 'z')
-        const multibaseEncoded = "z" + this.base58Encode(multicodecKey);
-        return `did:key:${multibaseEncoded}`;
-    }
-    /**
-     * Base58 encode (Bitcoin alphabet) using base-x library
-     */
-    base58Encode(bytes) {
-        return base58.encode(bytes);
-    }
-    /**
-     * Convert base64 or base64url to bytes
-     * Handles both standard base64 (+/) and base64url (-_) formats
-     */
-    base64ToBytes(base64) {
-        // Convert base64url to standard base64 if needed
-        // Base64url uses - instead of + and _ instead of /
-        let standardBase64 = base64.replace(/-/g, "+").replace(/_/g, "/");
-        // Add padding if needed (base64url often omits padding)
-        const paddingNeeded = (4 - (standardBase64.length % 4)) % 4;
-        standardBase64 += "=".repeat(paddingNeeded);
-        const binaryString = atob(standardBase64);
-        const bytes = new Uint8Array(binaryString.length);
-        for (let i = 0; i < binaryString.length; i++) {
-            bytes[i] = binaryString.charCodeAt(i);
-        }
-        return bytes;
-    }
 }
 //# sourceMappingURL=storage.js.map

package/dist/providers/storage.js.map

@@ -1 +1 @@
-{"version":3,"file":"storage.js","sourceRoot":"","sources":["../../src/providers/storage.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EACL,eAAe,EACf,kBAAkB,EAClB,aAAa,EACb,aAAa,EACb,gBAAgB,GAEjB,MAAM,aAAa,CAAC;AAErB,8CAA8C;AAC9C,OAAO,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAChD,OAAO,KAAK,MAAM,QAAQ,CAAC;AAE3B,0BAA0B;AAC1B,MAAM,MAAM,GAAG,KAAK,CAClB,4DAA4D,CAC7D,CAAC;AAsBF;;GAEG;AACH,MAAM,OAAO,iBAAkB,SAAQ,eAAe;IAChC;IAApB,YAAoB,EAAmB;QACrC,KAAK,EAAE,CAAC;QADU,OAAE,GAAF,EAAE,CAAiB;IAEvC,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,GAAW;QACnB,OAAO,MAAM,IAAI,CAAC,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAChC,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,GAAW,EAAE,KAAa;QAClC,MAAM,IAAI,CAAC,EAAE,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IAChC,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,GAAW;QACtB,MAAM,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAC5B,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,GAAW;QACtB,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACrC,OAAO,KAAK,KAAK,IAAI,CAAC;IACxB,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,MAAe;QACxB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;QAC9C,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IACxC,CAAC;CACF;AAED;;GAEG;AACH,MAAM,OAAO,oBAAqB,SAAQ,kBAAkB;IACtC;IAApB,YAAoB,EAAmB;QACrC,KAAK,EAAE,CAAC;QADU,OAAE,GAAF,EAAE,CAAiB;IAEvC,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,KAAa,EAAE,QAAiB;QACxC,MAAM,GAAG,GAAG,QAAQ,CAAC,CAAC,CAAC,SAAS,QAAQ,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,EAAE,CAAC;QACvE,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACrC,OAAO,KAAK,KAAK,IAAI,CAAC;IACxB,CAAC;IAED,KAAK,CAAC,GAAG,CACP,KAAa,EACb,UAAkB,EAClB,QAAiB;QAEjB,MAAM,GAAG,GAAG,QAAQ,CAAC,CAAC,CAAC,SAAS,QAAQ,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,EAAE,CAAC;QACvE,6EAA6E;QAC7E,MAAM,IAAI,CAAC,EAAE,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE;YAC1B,aAAa,EAAE,UAAU;SAC1B,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,OAAO;QACX,sCAAsC;IACxC,CAAC;IAED,KAAK,CAAC,OAAO;QACX,oBAAoB;IACtB,CAAC;CACF;AAED;;GAEG;AACH,MAAM,OAAO,oBAAqB,SAAQ,aAAa;IACrD,GAAG;QACD,OAAO,IAAI,CAAC,GAAG,EAAE,CAAC;IACpB,CAAC;IAED,YAAY,CAAC,SAAiB,EAAE,WAAmB;QACjD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,MAAM,GAAG,WAAW,GAAG,IAAI,CAAC;QAClC,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,GAAG,SAAS,CAAC,CAAC;QACvC,OAAO,IAAI,IAAI,MAAM,CAAC;IACxB,CAAC;IAED,UAAU,CAAC,SAAiB;QAC1B,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;IAChC,CAAC;IAED,eAAe,CAAC,UAAkB;QAChC,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,UAAU,GAAG,IAAI,CAAC;IACxC,CAAC;IAED,MAAM,CAAC,SAAiB;QACtB,OAAO,IAAI,IAAI,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE,CAAC;IAC3C,CAAC;CACF;AAED;;GAEG;AACH,MAAM,OAAO,oBAAqB,SAAQ,aAAa;IACrD,KAAK,CAAC,UAAU,CAAC,GAAW;QAC1B,IAAI,GAAG,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;YAC/B,iCAAiC;YACjC,MAAM,kBAAkB,GAAG,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;YACxD,OAAO;gBACL,UAAU,EAAE,CAAC,8BAA8B,CAAC;gBAC5C,EAAE,EAAE,GAAG;gBACP,kBAAkB,EAAE;oBAClB;wBACE,EAAE,EAAE,GAAG,GAAG,QAAQ;wBAClB,IAAI,EAAE,4BAA4B;wBAClC,UAAU,EAAE,GAAG;wBACf,kBAAkB;qBACnB;iBACF;gBACD,cAAc,EAAE,CAAC,GAAG,GAAG,QAAQ,CAAC;gBAChC,eAAe,EAAE,CAAC,GAAG,GAAG,QAAQ,CAAC;aAClC,CAAC;QACJ,CAAC;QAED,IAAI,GAAG,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;YAC/B,MAAM,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;YAC/D,MAAM,GAAG,GAAG,WAAW,MAAM,uBAAuB,CAAC;YACrD,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,CAAC;YAElC,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;gBACjB,MAAM,IAAI,KAAK,CAAC,qBAAqB,GAAG,KAAK,QAAQ,CAAC,UAAU,EAAE,CAAC,CAAC;YACtE,CAAC;YAED,OAAO,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QAC/B,CAAC;QAED,MAAM,IAAI,KAAK,CAAC,2BAA2B,GAAG,EAAE,CAAC,CAAC;IACpD,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,GAAW;QAC/B,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,CAAC;QAElC,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CAAC,gCAAgC,QAAQ,CAAC,UAAU,EAAE,CAAC,CAAC;QACzE,CAAC;QAED,OAAO,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;IAC/B,CAAC;IAED,KAAK,CAAC,oBAAoB,CAAC,EAAU;QACnC,yCAAyC;QACzC,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,GAAW,EAAE,OAAqB;QAC5C,OAAO,MAAM,KAAK,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IACnC,CAAC;CACF;AAYD;;;;;;;;;;GAUG;AACH,MAAM,UAAU,qBAAqB,CACnC,GAA0B;IAE1B,IACE,CAAC,GAAG,CAAC,wBAAwB;QAC7B,CAAC,GAAG,CAAC,uBAAuB;QAC5B,CAAC,GAAG,CAAC,sBAAsB,EAC3B,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO;QACL,GAAG,EAAE,GAAG,CAAC,sBAAsB;QAC/B,GAAG,EAAE,GAAG,GAAG,CAAC,sBAAsB,QAAQ;QAC1C,UAAU,EAAE,GAAG,CAAC,wBAAwB;QACxC,SAAS,EAAE,GAAG,CAAC,uBAAuB;QACtC,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACnC,IAAI,EAAE,YAAY;KACnB,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,OAAO,uBAAwB,SAAQ,gBAAgB;IAEjD;IACA;IACA;IAHV,YACU,GAAQ,EACR,cAAoB,EACpB,KAA0B;QAElC,KAAK,EAAE,CAAC;QAJA,QAAG,GAAH,GAAG,CAAK;QACR,mBAAc,GAAd,cAAc,CAAM;QACpB,UAAK,GAAL,KAAK,CAAqB;IAGpC,CAAC;IAED,KAAK,CAAC,WAAW;QACf,iEAAiE;QACjE,4FAA4F;QAC5F,MAAM,UAAU,GAAG,qBAAqB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACnD,IAAI,UAAU,EAAE,CAAC;YACf,kFAAkF;YAClF,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;gBACf,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,EAAE,UAAU,CAAC,CAAC;gBAC3D,OAAO,CAAC,KAAK,CACX,oDAAoD,EACpD,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,KAAK,CACpC,CAAC;YACJ,CAAC;YAED,OAAO,UAAU,CAAC;QACpB,CAAC;QAED,6EAA6E;QAC7E,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YACf,MAAM,MAAM,GACV,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAgB,gBAAgB,CAAC,CAAC;YAChE,IAAI,MAAM,EAAE,CAAC;gBACX,OAAO,CAAC,KAAK,CACX,4DAA4D,EAC5D,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,KAAK,CAChC,CAAC;gBACF,OAAO,MAAM,CAAC;YAChB,CAAC;QACH,CAAC;QAED,wCAAwC;QACxC,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC;YACzB,MAAM,IAAI,KAAK,CACb,oEAAoE,CACrE,CAAC;QACJ,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,eAAe,EAAE,CAAC;QAC5D,MAAM,GAAG,GAAG,IAAI,CAAC,wBAAwB,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAE7D,MAAM,QAAQ,GAAG;YACf,GAAG;YACH,GAAG,EAAE,GAAG,GAAG,QAAQ;YACnB,UAAU,EAAE,OAAO,CAAC,UAAU;YAC9B,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACnC,IAAI,EAAE,aAAsB;SAC7B,CAAC;QAEF,mCAAmC;QACnC,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,EAAE,QAAQ,CAAC,CAAC;YACzD,OAAO,CAAC,KAAK,CACX,uDAAuD,EACvD,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,KAAK,CAClC,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,IAAI,CACV,kEAAkE,EAClE,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,KAAK,CAClC,CAAC;QACJ,CAAC;QAED,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,QAAuB;QACxC,+BAA+B;QAC/B,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,EAAE,QAAQ,CAAC,CAAC;YACzD,OAAO,CAAC,KAAK,CACX,2CAA2C,EAC3C,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,KAAK,CAClC,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,IAAI,CACV,kGAAkG,CACnG,CAAC;QACJ,CAAC;IACH,CAAC;IAED,KAAK,CAAC,UAAU;QACd,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC;YACzB,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;QAC/D,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,eAAe,EAAE,CAAC;QAC5D,MAAM,GAAG,GAAG,IAAI,CAAC,wBAAwB,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAE7D,OAAO;YACL,GAAG;YACH,GAAG,EAAE,GAAG,GAAG,QAAQ;YACnB,UAAU,EAAE,OAAO,CAAC,UAAU;YAC9B,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACnC,IAAI,EAAE,YAAY;SACnB,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,cAAc;QAClB,OAAO,CAAC,IAAI,CAAC,oDAAoD,CAAC,CAAC;IACrE,CAAC;IAED;;;;;;;OAOG;IACK,wBAAwB,CAAC,SAAiB;QAChD,MAAM,cAAc,GAAG,IAAI,CAAC,aAAa,CAAC,SAAS,CAAC,CAAC;QAErD,qCAAqC;QACrC,MAAM,gBAAgB,GAAG,IAAI,UAAU,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;QAEtD,8BAA8B;QAC9B,MAAM,aAAa,GAAG,IAAI,UAAU,CAClC,gBAAgB,CAAC,MAAM,GAAG,cAAc,CAAC,MAAM,CAChD,CAAC;QACF,aAAa,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;QACpC,aAAa,CAAC,GAAG,CAAC,cAAc,EAAE,gBAAgB,CAAC,MAAM,CAAC,CAAC;QAE3D,2CAA2C;QAC3C,MAAM,gBAAgB,GAAG,GAAG,GAAG,IAAI,CAAC,YAAY,CAAC,aAAa,CAAC,CAAC;QAEhE,OAAO,WAAW,gBAAgB,EAAE,CAAC;IACvC,CAAC;IAED;;OAEG;IACK,YAAY,CAAC,KAAiB;QACpC,OAAO,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC9B,CAAC;IAED;;;OAGG;IACK,aAAa,CAAC,MAAc;QAClC,iDAAiD;QACjD,mDAAmD;QACnD,IAAI,cAAc,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QAElE,wDAAwD;QACxD,MAAM,aAAa,GAAG,CAAC,CAAC,GAAG,CAAC,cAAc,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QAC5D,cAAc,IAAI,GAAG,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;QAE5C,MAAM,YAAY,GAAG,IAAI,CAAC,cAAc,CAAC,CAAC;QAC1C,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;QAClD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,YAAY,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YAC7C,KAAK,CAAC,CAAC,CAAC,GAAG,YAAY,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;QACxC,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;CACF"}
+{"version":3,"file":"storage.js","sourceRoot":"","sources":["../../src/providers/storage.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EACL,eAAe,EACf,kBAAkB,EAClB,aAAa,EACb,aAAa,EACb,gBAAgB,EAEhB,YAAY,EACZ,cAAc,EACd,uBAAuB,EACvB,aAAa,EACb,oBAAoB,GACrB,MAAM,aAAa,CAAC;AAErB,OAAO,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAEhD,8CAA8C;AAC9C,OAAO,EAAE,iBAAiB,EAAE,CAAC;AAE7B;;;;GAIG;AACH,MAAM,cAAc,GAAG,oBAAoB,EAAE,CAAC;AAsB9C;;GAEG;AACH,MAAM,OAAO,iBAAkB,SAAQ,eAAe;IAChC;IAApB,YAAoB,EAAmB;QACrC,KAAK,EAAE,CAAC;QADU,OAAE,GAAF,EAAE,CAAiB;IAEvC,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,GAAW;QACnB,OAAO,MAAM,IAAI,CAAC,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAChC,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,GAAW,EAAE,KAAa;QAClC,MAAM,IAAI,CAAC,EAAE,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IAChC,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,GAAW;QACtB,MAAM,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAC5B,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,GAAW;QACtB,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACrC,OAAO,KAAK,KAAK,IAAI,CAAC;IACxB,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,MAAe;QACxB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;QAC9C,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IACxC,CAAC;CACF;AAED;;GAEG;AACH,MAAM,OAAO,oBAAqB,SAAQ,kBAAkB;IACtC;IAApB,YAAoB,EAAmB;QACrC,KAAK,EAAE,CAAC;QADU,OAAE,GAAF,EAAE,CAAiB;IAEvC,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,KAAa,EAAE,QAAiB;QACxC,MAAM,GAAG,GAAG,QAAQ,CAAC,CAAC,CAAC,SAAS,QAAQ,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,EAAE,CAAC;QACvE,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACrC,OAAO,KAAK,KAAK,IAAI,CAAC;IACxB,CAAC;IAED,KAAK,CAAC,GAAG,CACP,KAAa,EACb,UAAkB,EAClB,QAAiB;QAEjB,MAAM,GAAG,GAAG,QAAQ,CAAC,CAAC,CAAC,SAAS,QAAQ,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,EAAE,CAAC;QACvE,6EAA6E;QAC7E,MAAM,IAAI,CAAC,EAAE,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE;YAC1B,aAAa,EAAE,UAAU;SAC1B,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,OAAO;QACX,sCAAsC;IACxC,CAAC;IAED,KAAK,CAAC,OAAO;QACX,oBAAoB;IACtB,CAAC;CACF;AAED;;GAEG;AACH,MAAM,OAAO,oBAAqB,SAAQ,aAAa;IACrD,GAAG;QACD,OAAO,IAAI,CAAC,GAAG,EAAE,CAAC;IACpB,CAAC;IAED,YAAY,CAAC,SAAiB,EAAE,WAAmB;QACjD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,MAAM,GAAG,WAAW,GAAG,IAAI,CAAC;QAClC,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,GAAG,SAAS,CAAC,CAAC;QACvC,OAAO,IAAI,IAAI,MAAM,CAAC;IACxB,CAAC;IAED,UAAU,CAAC,SAAiB;QAC1B,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;IAChC,CAAC;IAED,eAAe,CAAC,UAAkB;QAChC,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,UAAU,GAAG,IAAI,CAAC;IACxC,CAAC;IAED,MAAM,CAAC,SAAiB;QACtB,OAAO,IAAI,IAAI,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE,CAAC;IAC3C,CAAC;CACF;AAED;;GAEG;AACH,MAAM,OAAO,oBAAqB,SAAQ,aAAa;IACrD,KAAK,CAAC,UAAU,CAAC,GAAW;QAC1B,IAAI,GAAG,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;YAC/B,uEAAuE;YACvE,oEAAoE;YACpE,wEAAwE;YACxE,yEAAyE;YACzE,kEAAkE;YAClE,0EAA0E;YAC1E,wEAAwE;YACxE,wBAAwB;YACxB,MAAM,GAAG,GAAG,MAAM,cAAc,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YAC9C,IAAI,CAAC,GAAG,EAAE,CAAC;gBACT,MAAM,IAAI,KAAK,CACb,qBAAqB,GAAG,2BAA2B;oBACjD,gEAAgE,CACnE,CAAC;YACJ,CAAC;YACD,OAAO;gBACL,UAAU,EAAE,CAAC,8BAA8B,CAAC;gBAC5C,GAAG,GAAG;aACP,CAAC;QACJ,CAAC;QAED,IAAI,GAAG,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;YAC/B,MAAM,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;YAC/D,MAAM,GAAG,GAAG,WAAW,MAAM,uBAAuB,CAAC;YACrD,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,CAAC;YAElC,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;gBACjB,MAAM,IAAI,KAAK,CAAC,qBAAqB,GAAG,KAAK,QAAQ,CAAC,UAAU,EAAE,CAAC,CAAC;YACtE,CAAC;YAED,OAAO,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QAC/B,CAAC;QAED,MAAM,IAAI,KAAK,CAAC,2BAA2B,GAAG,EAAE,CAAC,CAAC;IACpD,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,GAAW;QAC/B,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,CAAC;QAElC,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CAAC,gCAAgC,QAAQ,CAAC,UAAU,EAAE,CAAC,CAAC;QACzE,CAAC;QAED,OAAO,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;IAC/B,CAAC;IAED,KAAK,CAAC,oBAAoB,CAAC,EAAU;QACnC,yCAAyC;QACzC,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,GAAW,EAAE,OAAqB;QAC5C,OAAO,MAAM,KAAK,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IACnC,CAAC;CACF;AAuBD;;;;;GAKG;AACH,MAAM,OAAO,uBAAwB,SAAQ,KAAK;IACvC,QAAQ,CAA6B;IAE9C,YAAY,QAAoC,EAAE,MAAc;QAC9D,KAAK,CACH,4CAA4C,QAAQ,MAAM,MAAM,GAAG;YACjE,2EAA2E;YAC3E,2EAA2E;YAC3E,yEAAyE,CAC5E,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,yBAAyB,CAAC;QACtC,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;IAC3B,CAAC;CACF;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,SAAS,CAAC,GAAW;IACnC,OAAO,YAAY,CAAC,GAAG,CAAC,KAAK,KAAK;QAChC,CAAC,CAAC,GAAG,GAAG,IAAI,cAAc,CAAC,GAAG,CAAC,EAAE;QACjC,CAAC,CAAC,GAAG,GAAG,QAAQ,CAAC;AACrB,CAAC;AAED,SAAS,UAAU,CAAC,IAAgB,EAAE,KAAiB;IACrD,IAAI,IAAI,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC/C,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE;QAAE,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;IACjE,OAAO,IAAI,KAAK,CAAC,CAAC;AACpB,CAAC;AAED,MAAM,wBAAwB,GAAG,EAAE,CAAC;AAEpC;;;;;GAKG;AACH,MAAM,UAAU,wBAAwB,CACtC,GAA0B;IAM1B,OAAO,OAAO,CACZ,GAAG,CAAC,wBAAwB;QAC1B,GAAG,CAAC,uBAAuB;QAC3B,GAAG,CAAC,sBAAsB,CAC7B,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,sBAAsB,GAAG,IAAI,OAAO,EAGvC,CAAC;AAEJ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,GAA0B;IAE1B,IAAI,CAAC,wBAAwB,CAAC,GAAG,CAAC,EAAE,CAAC;QACnC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC;QAC5B,GAAG,CAAC,wBAAwB;QAC5B,GAAG,CAAC,uBAAuB;QAC3B,GAAG,CAAC,sBAAsB;KAC3B,CAAC,CAAC;IACH,MAAM,QAAQ,GAAG,sBAAsB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACjD,IAAI,QAAQ,IAAI,QAAQ,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;QAC3C,OAAO,QAAQ,CAAC,MAAM,CAAC;IACzB,CAAC;IAED,MAAM,MAAM,GAAG,wBAAwB,CAAC;QACtC,UAAU,EAAE,GAAG,CAAC,wBAAwB;QACxC,SAAS,EAAE,GAAG,CAAC,uBAAuB;QACtC,GAAG,EAAE,GAAG,CAAC,sBAAsB;KAChC,CAAC,CAAC;IACH,sBAAsB,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IACpD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,8EAA8E;AAC9E,KAAK,UAAU,wBAAwB,CAAC,UAIvC;IACC,MAAM,EAAE,GAAG,EAAE,GAAG,UAAU,CAAC;IAE3B,yEAAyE;IACzE,0EAA0E;IAC1E,0EAA0E;IAC1E,IAAI,wBAAoC,CAAC;IACzC,IAAI,CAAC;QACH,wBAAwB,GAAG,aAAa,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;IACjE,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,uBAAuB,CAC/B,YAAY,EACZ,yDAAyD;YACvD,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAC/D,CAAC;IACJ,CAAC;IACD,IAAI,wBAAwB,CAAC,MAAM,KAAK,wBAAwB,EAAE,CAAC;QACjE,MAAM,IAAI,uBAAuB,CAC/B,YAAY,EACZ,qEAAqE;YACnE,QAAQ,wBAAwB,CAAC,MAAM,oCAAoC,CAC9E,CAAC;IACJ,CAAC;IAED,IAAI,gBAAwB,CAAC;IAC7B,IAAI,CAAC;QACH,gBAAgB,GAAG,MAAM,IAAI,iBAAiB,EAAE,CAAC,eAAe,CAC9D,UAAU,CAAC,UAAU,CACtB,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,uBAAuB,CAC/B,aAAa,EACb,+DAA+D;YAC7D,uEAAuE;YACvE,eAAe,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAC3E,CAAC;IACJ,CAAC;IAED,yEAAyE;IACzE,yDAAyD;IACzD,IAAI,CAAC,UAAU,CAAC,aAAa,CAAC,gBAAgB,CAAC,EAAE,wBAAwB,CAAC,EAAE,CAAC;QAC3E,MAAM,IAAI,uBAAuB,CAC/B,wBAAwB,EACxB,8DAA8D;YAC5D,0EAA0E,CAC7E,CAAC;IACJ,CAAC;IAED,IAAI,YAAY,CAAC,GAAG,CAAC,KAAK,KAAK,EAAE,CAAC;QAChC,MAAM,eAAe,GAAG,uBAAuB,CAAC,wBAAwB,CAAC,CAAC;QAC1E,IAAI,eAAe,KAAK,GAAG,EAAE,CAAC;YAC5B,MAAM,IAAI,uBAAuB,CAC/B,sBAAsB,EACtB,6BAA6B,GAAG,+BAA+B;gBAC7D,cAAc,eAAe,GAAG,CACnC,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO;QACL,GAAG;QACH,GAAG,EAAE,SAAS,CAAC,GAAG,CAAC;QACnB,UAAU,EAAE,UAAU,CAAC,UAAU;QACjC,SAAS,EAAE,UAAU,CAAC,SAAS;QAC/B,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACnC,IAAI,EAAE,YAAY;KACnB,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,OAAO,uBAAwB,SAAQ,gBAAgB;IAWjD;IACA;IACA;IAZV;;;;;;OAMG;IACK,2BAA2B,CAAiB;IAEpD,YACU,GAAQ,EACR,cAAoB,EACpB,KAA0B;QAElC,KAAK,EAAE,CAAC;QAJA,QAAG,GAAH,GAAG,CAAK;QACR,mBAAc,GAAd,cAAc,CAAM;QACpB,UAAK,GAAL,KAAK,CAAqB;IAGpC,CAAC;IAED,KAAK,CAAC,WAAW;QACf,iEAAiE;QACjE,4FAA4F;QAC5F,IAAI,UAAgC,CAAC;QACrC,IAAI,CAAC;YACH,UAAU,GAAG,MAAM,qBAAqB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACrD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,yEAAyE;YACzE,yEAAyE;YACzE,wEAAwE;YACxE,sEAAsE;YACtE,OAAO,CAAC,KAAK,CACX,gEAAgE,EAChE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CACvD,CAAC;YACF,MAAM,KAAK,CAAC;QACd,CAAC;QACD,IAAI,UAAU,EAAE,CAAC;YACf,wEAAwE;YACxE,8EAA8E;YAC9E,IAAI,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,2BAA2B,KAAK,UAAU,EAAE,CAAC;gBAClE,iEAAiE;gBACjE,kEAAkE;gBAClE,uEAAuE;gBACvE,IAAI,CAAC,2BAA2B,GAAG,UAAU,CAAC;gBAC9C,IAAI,CAAC;oBACH,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,EAAE,UAAU,CAAC,CAAC;gBAC7D,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,IAAI,CAAC,2BAA2B,GAAG,SAAS,CAAC;oBAC7C,MAAM,KAAK,CAAC;gBACd,CAAC;gBACD,OAAO,CAAC,KAAK,CACX,oDAAoD,EACpD,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,KAAK,CACpC,CAAC;YACJ,CAAC;YAED,OAAO,UAAU,CAAC;QACpB,CAAC;QAED,6EAA6E;QAC7E,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YACf,MAAM,MAAM,GACV,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAgB,gBAAgB,CAAC,CAAC;YAChE,IAAI,MAAM,EAAE,CAAC;gBACX,OAAO,CAAC,KAAK,CACX,4DAA4D,EAC5D,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,KAAK,CAChC,CAAC;gBACF,OAAO,MAAM,CAAC;YAChB,CAAC;QACH,CAAC;QAED,wCAAwC;QACxC,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC;YACzB,MAAM,IAAI,KAAK,CACb,oEAAoE,CACrE,CAAC;QACJ,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,eAAe,EAAE,CAAC;QAC5D,MAAM,GAAG,GAAG,uBAAuB,CAAC,aAAa,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC;QAEtE,MAAM,QAAQ,GAAG;YACf,GAAG;YACH,GAAG,EAAE,SAAS,CAAC,GAAG,CAAC;YACnB,UAAU,EAAE,OAAO,CAAC,UAAU;YAC9B,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACnC,IAAI,EAAE,aAAsB;SAC7B,CAAC;QAEF,mCAAmC;QACnC,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,EAAE,QAAQ,CAAC,CAAC;YACzD,OAAO,CAAC,KAAK,CACX,uDAAuD,EACvD,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,KAAK,CAClC,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,IAAI,CACV,kEAAkE,EAClE,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,KAAK,CAClC,CAAC;QACJ,CAAC;QAED,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,QAAuB;QACxC,+BAA+B;QAC/B,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,EAAE,QAAQ,CAAC,CAAC;YACzD,OAAO,CAAC,KAAK,CACX,2CAA2C,EAC3C,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,KAAK,CAClC,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,IAAI,CACV,kGAAkG,CACnG,CAAC;QACJ,CAAC;IACH,CAAC;IAED,KAAK,CAAC,UAAU;QACd,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC;YACzB,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;QAC/D,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,eAAe,EAAE,CAAC;QAC5D,MAAM,GAAG,GAAG,uBAAuB,CAAC,aAAa,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC;QAEtE,OAAO;YACL,GAAG;YACH,GAAG,EAAE,SAAS,CAAC,GAAG,CAAC;YACnB,UAAU,EAAE,OAAO,CAAC,UAAU;YAC9B,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACnC,IAAI,EAAE,YAAY;SACnB,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,cAAc;QAClB,OAAO,CAAC,IAAI,CAAC,oDAAoD,CAAC,CAAC;IACrE,CAAC;CACF"}

package/dist/services/proof.service.d.ts

@@ -51,9 +51,10 @@ export declare class ProofService {
      * Notify Reputation Engine of an interaction
      *
      * Fire-and-forget: Errors are swallowed to prevent blocking proof submission.
-     * Only notifies if agent is registered with KTA (opt-in via registration).
-     *
-     * Uses built-in API key - users don't need to configure anything.
+     * Two opt-in gates must both hold before anything is sent:
+     *   1. the agent is registered with KTA (`KTA_REGISTRATION.registered`), and
+     *   2. the deployment carries its own `REPUTATION_API_KEY` binding
+     *      (a Workers secret). The package never bundles a credential.
      *
      * @param agentDid - The agent's DID
      * @param context - The proof submission context containing success status